|
29 | 29 | "rule_name": "User Discovery via Whoami", |
30 | 30 | "stack_version": "7.14.0" |
31 | 31 | }, |
| 32 | + "125417b8-d3df-479f-8418-12d7e034fee3": { |
| 33 | + "deprecation_date": "2022/07/25", |
| 34 | + "rule_name": "Attempt to Disable IPTables or Firewall", |
| 35 | + "stack_version": "7.16" |
| 36 | + }, |
32 | 37 | "139c7458-566a-410c-a5cd-f80238d6a5cd": { |
33 | 38 | "deprecation_date": "2021/04/15", |
34 | 39 | "rule_name": "SQL Traffic to the Internet", |
|
39 | 44 | "rule_name": "Linux Restricted Shell Breakout via c89/c99 Shell evasion", |
40 | 45 | "stack_version": "7.16" |
41 | 46 | }, |
| 47 | + "20dc4620-3b68-4269-8124-ca5091e00ea8": { |
| 48 | + "deprecation_date": "2022/07/25", |
| 49 | + "rule_name": "Auditd Max Login Sessions", |
| 50 | + "stack_version": "7.16" |
| 51 | + }, |
| 52 | + "3605a013-6f0c-4f7d-88a5-326f5be262ec": { |
| 53 | + "deprecation_date": "2022/08/01", |
| 54 | + "rule_name": "Potential Privilege Escalation via Local Kerberos Relay over LDAP", |
| 55 | + "stack_version": "7.16" |
| 56 | + }, |
42 | 57 | "3a86e085-094c-412d-97ff-2439731e59cb": { |
43 | 58 | "deprecation_date": "2021/03/03", |
44 | 59 | "rule_name": "Setgid Bit Set via chmod", |
|
74 | 89 | "rule_name": "Query Registry via reg.exe", |
75 | 90 | "stack_version": "7.14.0" |
76 | 91 | }, |
| 92 | + "6ea71ff0-9e95-475b-9506-2580d1ce6154": { |
| 93 | + "deprecation_date": "2022/08/02", |
| 94 | + "rule_name": "DNS Activity to the Internet", |
| 95 | + "stack_version": "7.16" |
| 96 | + }, |
77 | 97 | "6f1500bc-62d7-4eb9-8601-7485e87da2f4": { |
78 | 98 | "deprecation_date": "2021/04/15", |
79 | 99 | "rule_name": "SSH (Secure Shell) to the Internet", |
|
94 | 114 | "rule_name": "Network Sniffing via Tcpdump", |
95 | 115 | "stack_version": "7.14.0" |
96 | 116 | }, |
| 117 | + "7b08314d-47a0-4b71-ae4e-16544176924f": { |
| 118 | + "deprecation_date": "2022/08/02", |
| 119 | + "rule_name": "File and Directory Discovery", |
| 120 | + "stack_version": "7.16" |
| 121 | + }, |
97 | 122 | "7d2c38d7-ede7-4bdf-b140-445906e6c540": { |
98 | 123 | "deprecation_date": "2021/04/15", |
99 | 124 | "rule_name": "Tor Activity to the Internet", |
|
124 | 149 | "rule_name": "Linux Restricted Shell Breakout via apt/apt-get Changelog Escape", |
125 | 150 | "stack_version": "7.16" |
126 | 151 | }, |
| 152 | + "90e28af7-1d96-4582-bf11-9a1eff21d0e5": { |
| 153 | + "deprecation_date": "2022/07/25", |
| 154 | + "rule_name": "Auditd Login Attempt at Forbidden Time", |
| 155 | + "stack_version": "7.16" |
| 156 | + }, |
127 | 157 | "97da359b-2b61-4a40-b2e4-8fc48cf7a294": { |
128 | 158 | "deprecation_date": "2022/05/09", |
129 | 159 | "rule_name": "Linux Restricted Shell Breakout via the SSH command", |
|
169 | 199 | "rule_name": "Nmap Process Activity", |
170 | 200 | "stack_version": "7.14.0" |
171 | 201 | }, |
| 202 | + "cab4f01c-793f-4a54-a03e-e5d85b96d7af": { |
| 203 | + "deprecation_date": "2022/07/25", |
| 204 | + "rule_name": "Auditd Login from Forbidden Location", |
| 205 | + "stack_version": "7.16" |
| 206 | + }, |
172 | 207 | "cc16f774-59f9-462d-8b98-d27ccd4519ec": { |
173 | 208 | "deprecation_date": "2021/04/15", |
174 | 209 | "rule_name": "Process Discovery via Tasklist", |
|
184 | 219 | "rule_name": "PPTP (Point to Point Tunneling Protocol) Activity", |
185 | 220 | "stack_version": "7.14.0" |
186 | 221 | }, |
| 222 | + "d6450d4e-81c6-46a3-bd94-079886318ed5": { |
| 223 | + "deprecation_date": "2022/07/28", |
| 224 | + "rule_name": "Strace Process Activity", |
| 225 | + "stack_version": "7.16" |
| 226 | + }, |
187 | 227 | "da986d2c-ffbf-4fd6-af96-a88dbf68f386": { |
188 | 228 | "deprecation_date": "2022/05/09", |
189 | 229 | "rule_name": "Linux Restricted Shell Breakout via the gcc command", |
|
194 | 234 | "rule_name": "Threat Intel Filebeat Module (v7.x) Indicator Match", |
195 | 235 | "stack_version": "8.0" |
196 | 236 | }, |
| 237 | + "df959768-b0c9-4d45-988c-5606a2be8e5a": { |
| 238 | + "deprecation_date": "2022/07/25", |
| 239 | + "rule_name": "Unusual Process Execution - Temp", |
| 240 | + "stack_version": "7.16" |
| 241 | + }, |
| 242 | + "e0dacebe-4311-4d50-9387-b17e89c2e7fd": { |
| 243 | + "deprecation_date": "2022/08/02", |
| 244 | + "rule_name": "Whitespace Padding in Process Command Line", |
| 245 | + "stack_version": "7.16" |
| 246 | + }, |
197 | 247 | "e56993d2-759c-4120-984c-9ec9bb940fd5": { |
198 | 248 | "deprecation_date": "2021/04/15", |
199 | 249 | "rule_name": "RDP (Remote Desktop Protocol) to the Internet", |
|
219 | 269 | "rule_name": "Linux Restricted Shell Breakout via flock Shell evasion", |
220 | 270 | "stack_version": "7.16" |
221 | 271 | }, |
| 272 | + "fb9937ce-7e21-46bf-831d-1ad96eac674d": { |
| 273 | + "deprecation_date": "2022/07/25", |
| 274 | + "rule_name": "Auditd Max Failed Login Attempts", |
| 275 | + "stack_version": "7.16" |
| 276 | + }, |
222 | 277 | "fd3fc25e-7c7c-4613-8209-97942ac609f6": { |
223 | 278 | "deprecation_date": "2022/05/09", |
224 | 279 | "rule_name": "Linux Restricted Shell Breakout via the expect command", |
|
0 commit comments